Xin-Yue Song

The issue concerns a lack of validation in the administrator interface of IDExpert, allowing remote attackers with administrative privileges to inject and execute OS commands on the server. This can be exploited by injecting a specific parameter.

The Administrative Management System from Wellchoose has a Path Traversal issue, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.

The Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells. This issue can be exploited by attackers to gain unauthorized access to the system.

The Administrative Management System from Wellchoose has an OS Command Injection issue, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.

The AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content.

The issue is related to a path traversal vulnerability in a special function of the NCSIST ManageEngine Mobile Device Manager(MDM) APP. This vulnerability can be exploited by an unauthenticated remote attacker to bypass authentication and read arbitrary system files.